Date: Wed, 20 May 2015 18:43:46 +0300 From: Aleksey Cherepanov <lyosha@...nwall.com> To: john-dev@...ts.openwall.com Subject: Re: Johnny: 1.5.2 Hash type suggestion/guessing, using --show=types (was: displaying full meta information about hashes with --show=types) Mathieu, Shinnok, On Wed, May 20, 2015 at 11:09:35AM -0400, Mathieu Laprise wrote: > Aleksey, > > Aleksey wrote: > > > Files in PWDUMP format need special handling: per line list show only > > lm and nt, lm for 3rd field and nt for 4th field. IIRC Johnny shows lm > > and nt on separate lines. When you read the file with hashes, you may > > need to remember if line is in PWDUMP format. I am sure you'll find a > > way to connect everything correctly. > > I tested Johnny behavior regarding PWDUMP file and the LM part is in the > "Hash" field and the NT field is in the GECOS. > For example : > Administrator:500:207277225E983B147AC464727886BD82: > 90BBDB25BC6556610DAA4F03900FBE92::: > > will appear in Johnny : > Login : Administrator > Hash : 207277225E983B147AC464727886BD82 > GECOS : 500:90BBDB25BC6556610DAA4F03900FBE92 Oh, I thought pwdump is fully supported in Johnny. But it turns out that only LMs are loaded. It raises an interesting question: how should it look like? Two hashes on 1 line? Two lines (bad case, see below)? > I also dumped my own local hashes from windows 8.1 with Quarkspwdump and I > got similar results. > > Is it what you meant by separate lines ? I thought "separate lines" meant > having two rows : 1. administrator, LM and 2. administrator NT so I want to > make sure this is not a bug. It is not a "bug", it is just not implemented. I am not sure that showing 2 hashes on 2 lines would be ok because passwords of these hashes are connected: if password is shorter than 15 chars then LM has the same password as NT, if password is longer or equal to 15 chars than only NT is used (LM is either LM with empty password or not showed at all depending on dumping tool). LMs are not case sensitive, so the common scenario is the following: crack LM, then toggle case to find NT. So there is no need to separate LM and NT. Thanks! -- Regards, Aleksey Cherepanov
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.